core: remove references to OPTEE_SMC_SHM_CACHED

Removes references to OPTEE_SMC_SHM_CACHED in architecture independent
code, the references are replaces by TEE_MATTR_CACHE_CACHED which is
more accur

core: remove references to OPTEE_SMC_SHM_CACHED

Removes references to OPTEE_SMC_SHM_CACHED in architecture independent
code, the references are replaces by TEE_MATTR_CACHE_CACHED which is
more accurate.

Acked-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Add property to check feature PAUTH in TEE property set

Add an entry in TEE_PROPSET_TEE_IMPLEMENTATION for a boolean
property org.trustedfirmware.optee.cpu.feat_pauth_implemented.
The property

core: Add property to check feature PAUTH in TEE property set

Add an entry in TEE_PROPSET_TEE_IMPLEMENTATION for a boolean
property org.trustedfirmware.optee.cpu.feat_pauth_implemented.
The property is set true only if CFG_TA_PAUTH is configured and
the underlying CPU supports FEAT_PAuth/FEAT_PAuth2.

Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ree_fs_open(): close dirfile on error

Updates ree_fs_open() to close the dirfile on error. This should take
care of the rare case were the internal file handle in the dirfile has
been closed d

core: ree_fs_open(): close dirfile on error

Updates ree_fs_open() to close the dirfile on error. This should take
care of the rare case were the internal file handle in the dirfile has
been closed due to an error.

Fixes an error like:
E/TC:1 1 Core data-abort at address 0xc0 (translation fault)
E/TC:1 1 esr 0x96000006 ttbr0 0x600000e19a020 ttbr1 0x00000000 cidr 0x0
E/TC:1 1 cpu #1 cpsr 0x00000004
E/TC:1 1 x0 00000000000000c0 x1 0000000000000078
E/TC:1 1 x2 000000000e1a0c88 x3 000000000e1a0c28
E/TC:1 1 x4 0000000000000078 x5 000000000e128220
E/TC:1 1 x6 000000000000001f x7 0000000000000000
E/TC:1 1 x8 0000000000000000 x9 0000000000000000
E/TC:1 1 x10 0000000000000000 x11 0000000000000000
E/TC:1 1 x12 0000000000000000 x13 0000000040014f80
E/TC:1 1 x14 0000000000000000 x15 0000000000000000
E/TC:1 1 x16 000000000e12f318 x17 0000000000000000
E/TC:1 1 x18 0000000000000000 x19 0000000000000078
E/TC:1 1 x20 0000000000000000 x21 000000000e1a0c28
E/TC:1 1 x22 00000000ffffffff x23 000000000e1a0c88
E/TC:1 1 x24 000000000e1891c4 x25 000000000e17d1b0
E/TC:1 1 x26 000000000e17de50 x27 000000000e1891c4
E/TC:1 1 x28 0000000000000000 x29 000000000e1a0b90
E/TC:1 1 x30 000000000e128254 elr 000000000e128260
E/TC:1 1 sp_el0 000000000e1a0b90
E/TC:1 1 TEE load address @ 0xe100000
E/TC:1 1 Call stack:
E/TC:1 1 0x0e128260 ree_fs_read_primitive at core/tee/tee_ree_fs.c:311
E/TC:1 1 0x0e129324 read_dent at core/tee/fs_dirfile.c:89
E/TC:1 1 0x0e129770 tee_fs_dirfile_find at core/tee/fs_dirfile.c:213
E/TC:1 1 0x0e128f1c set_name at core/tee/tee_ree_fs.c:664
E/TC:1 1 0x0e125954 tee_svc_storage_init_file at core/tee/tee_svc_storage.c:297
E/TC:1 1 0x0e10d514 tee_svc_do_call at core/arch/arm/tee/arch_svc_a64.S:140
E/TC:1 1 0x0e1062ec thread_svc_handler at core/arch/arm/kernel/thread.c:1585 (discriminator 4)
E/TC:1 1 0x0e103618 el0_svc at core/arch/arm/kernel/thread_a64.S:651

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: crypto: TEE_PopulateTransientObject() should check key size

The GlobalPlatform TEE Internal Core API specification specifies the
panic reasons for TEE_PopulateTransientObject() as follows:
"If

core: crypto: TEE_PopulateTransientObject() should check key size

The GlobalPlatform TEE Internal Core API specification specifies the
panic reasons for TEE_PopulateTransientObject() as follows:
"If the implementation detects any other error associated with this
function that is not explicitly associated with a defined return code
for this function.". There is no explicit return code for the case of
an attribute that would be an invalid key length for the specified
algorithm, but it seems that panicking the TA would be permitted and
even desirable in order to prevent other issues with subsequent calls
using such a key.

Add a key size check to tee_svc_cryp_obj_populate_type() so that
syscall_cryp_obj_populate() will return TEE_ERROR_BAD_PARAMETER when
a key of invalid length is supplied. This error code is converted into
a panic by TEE_PopulateTransientObject().

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: crypto: DSA key size is given by TEE_ATTR_DSA_PRIME

The size of a DSA key is the size of the prime number (p) and not the
size of the subprime (q). Therefore the size indicator flag in the
def

core: crypto: DSA key size is given by TEE_ATTR_DSA_PRIME

The size of a DSA key is the size of the prime number (p) and not the
size of the subprime (q). Therefore the size indicator flag in the
definition of DSA cryptographic object attributes should be associated
with TEE_ATTR_DSA_PRIME, not with TEE_ATTR_DSA_SUBPRIME.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: make mobj_get_va() more secure

Adds a length parameter to allow mobj_get_va() to check that the entire
va range requested is available.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.

core: make mobj_get_va() more secure

Adds a length parameter to allow mobj_get_va() to check that the entire
va range requested is available.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add asynchronous notifications

Adds support for asynchronous notifications from secure world to normal
world. This allows a design with a top half and bottom half type of
driver where the top

core: add asynchronous notifications

Adds support for asynchronous notifications from secure world to normal
world. This allows a design with a top half and bottom half type of
driver where the top half runs in secure interrupt context and a
notifications tells normal world to schedule a yielding call to do the
bottom half processing.

The protocol is defined in optee_msg.h optee_rpc_cmd.h and optee_smc.h.

A notification consists of a 32-bit value which normal world can
retrieve using a fastcall into secure world. OP-TEE is currently only
supporting the value 0-63 where 0 has a special meaning. When 0 is sent
it means that normal world is supposed to make a yielding call
OPTEE_MSG_CMD_DO_BOTTOM_HALF.

The notification framework in OP-TEE defines an interface where drivers
can register a callback which is called on each yielding bottom half
call.

Notification capability is negotiated with the normal world while it
initializes its driver. If both sides supports these notifications then
they are enabled.

CFG_CORE_ASYNC_NOTIF_GIC_INTID is added to define the hardware interrupt
used to notify normal world. This is added to the DTB in case OP-TEE can
is configured with CFG_DT=y. Other cases requires the normal world DTB
to be kept in sync with this.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Add property to check feature BTI in TEE property set

Add an entry in TEE_PROPSET_TEE_IMPLEMENTATION for a boolean
property org.trustedfirmware.optee.cpu.feat_bti_implemented.
The property is

core: Add property to check feature BTI in TEE property set

Add an entry in TEE_PROPSET_TEE_IMPLEMENTATION for a boolean
property org.trustedfirmware.optee.cpu.feat_bti_implemented.
The property is set true only if CFG_TA_BTI is configured and
the underlying CPU supports FEAT_BTI.

Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: dt_driver: helper for dependency on crypt service

Adds dt_driver_get_crypto() function to allow drivers to request
probe deferral when depending on core crypto services. For that purpose
tee_c

core: dt_driver: helper for dependency on crypt service

Adds dt_driver_get_crypto() function to allow drivers to request
probe deferral when depending on core crypto services. For that purpose
tee_cryp_init() is changed to call dt_driver_crypt_init_complete() once
crypt layer initialization completes.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: move functions from tee_svc_storage.c to tee_rpmb_fs.c

tee_svc_storage_create_filename() and tee_svc_storage_create_dirname() are
only used in core/tee/tee_rpmb_fs.c, so move them there and ma

core: move functions from tee_svc_storage.c to tee_rpmb_fs.c

tee_svc_storage_create_filename() and tee_svc_storage_create_dirname() are
only used in core/tee/tee_rpmb_fs.c, so move them there and make them
static. Since they now have file scope they may as well be given shorter
names.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: move FS files out of CFG_WITH_USER_TA

Some files which are currently guarded with CFG_WITH_USER_TA should be
guarded with _CFG_WITH_SECURE_STORAGE or FS-specific configs (CFG_RPMB_FS,
CFG_RPMB

core: move FS files out of CFG_WITH_USER_TA

Some files which are currently guarded with CFG_WITH_USER_TA should be
guarded with _CFG_WITH_SECURE_STORAGE or FS-specific configs (CFG_RPMB_FS,
CFG_RPMB_FS). This will allow the use of secure storage from kernel code
when CFG_WITH_USER_TA=n.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix build dependencies for fs_htree.c

core/tee/fs_htree.c is used when CFG_REE_FS=y, and is also used by the
test PTA core/pta/tests/fs_htree.c. Rather than make the implementation
depend on t

core: fix build dependencies for fs_htree.c

core/tee/fs_htree.c is used when CFG_REE_FS=y, and is also used by the
test PTA core/pta/tests/fs_htree.c. Rather than make the implementation
depend on the test (CFG_TEE_CORE_EMBED_INTERNAL_TESTS), do the opposite.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: move tee_svc_storage_create_filename_dfh() to core/tee/tee_fs_rpc.c

tee_svc_storage_create_filename_dfh() is only used in
core/tee/tee_fs_rpc.c, so move it there, make it static and give it a

core: move tee_svc_storage_create_filename_dfh() to core/tee/tee_fs_rpc.c

tee_svc_storage_create_filename_dfh() is only used in
core/tee/tee_fs_rpc.c, so move it there, make it static and give it a
shorter name: create_filename().

Fundamentally, this function is needed when CFG_REE_FS=y but the whole
file core/tee/tee_svc_storage.c (which is the current location of this
function) essentially defines the storage syscalls for TAs and is
therefore not needed when CFG_WITH_USER_TA=n. If we want to later be
able to exclude it from the build while still providing secure storage
to kernel code, the function has to move.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Fix warnings in core/tee/socket.c

Fixes -Wdeclaration-after-statement warnings in core/tee/socket.c:
core/tee/socket.c: In function ‘socket_open’:
core/tee/socket.c:44:2: error: ISO C90 forbid

core: Fix warnings in core/tee/socket.c

Fixes -Wdeclaration-after-statement warnings in core/tee/socket.c:
core/tee/socket.c: In function ‘socket_open’:
core/tee/socket.c:44:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
struct thread_param tpm[4] = {
^~~~~~
core/tee/socket.c: In function ‘socket_close’:
core/tee/socket.c:76:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
struct thread_param tpm = THREAD_PARAM_VALUE(IN, OPTEE_RPC_SOCKET_CLOSE,
^~~~~~
core/tee/socket.c: In function ‘socket_send’:
core/tee/socket.c:108:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
struct thread_param tpm[3] = {
^~~~~~
core/tee/socket.c: In function ‘socket_recv’:
core/tee/socket.c:147:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
struct thread_param tpm[3] = {
^~~~~~
core/tee/socket.c: In function ‘socket_ioctl’:
core/tee/socket.c:190:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
struct thread_param tpm[3] = {
^~~~~~

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Fix warnings in core/tee/tadb.c

Fixes -Wdeclaration-after-statement warnings in core/tee/tadb.c:
core/tee/tadb.c:111:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-

core: Fix warnings in core/tee/tadb.c

Fixes -Wdeclaration-after-statement warnings in core/tee/tadb.c:
core/tee/tadb.c:111:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
struct thread_param params[] = {
^~~~~~
core/tee/tadb.c: In function ‘ta_operation_remove’:
core/tee/tadb.c:137:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
struct thread_param params[] = {
^~~~~~
core/tee/tadb.c: In function ‘ta_load’:
core/tee/tadb.c:712:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
struct thread_param params[] = {
^~~~~~

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Fix warnings in core/tee/tee_fs_rpc.c

Fixes -Wdeclaration-after-statement warnings in core/tee/tee_fs_rpc.c:
core/tee/tee_fs_rpc.c: In function ‘operation_open_dfh’:
core/tee/tee_fs_rpc.c:49:2

core: Fix warnings in core/tee/tee_fs_rpc.c

Fixes -Wdeclaration-after-statement warnings in core/tee/tee_fs_rpc.c:
core/tee/tee_fs_rpc.c: In function ‘operation_open_dfh’:
core/tee/tee_fs_rpc.c:49:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
struct tee_fs_rpc_operation op = {
^~~~~~
core/tee/tee_fs_rpc.c: In function ‘tee_fs_rpc_remove_dfh’:
core/tee/tee_fs_rpc.c:192:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
struct tee_fs_rpc_operation op = {
^~~~~~

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Fix warnings in core/tee/tee_svc_cryp.c

Fixes -Wdeclaration-after-statement warnings in core/tee/tee_svc_cryp.c:
core/tee/tee_svc_cryp.c: In function ‘syscall_cryp_obj_populate’:
core/tee/tee_

core: Fix warnings in core/tee/tee_svc_cryp.c

Fixes -Wdeclaration-after-statement warnings in core/tee/tee_svc_cryp.c:
core/tee/tee_svc_cryp.c: In function ‘syscall_cryp_obj_populate’:
core/tee/tee_svc_cryp.c:1665:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
size_t alloc_size = 0;
^~~~~~
core/tee/tee_svc_cryp.c: In function ‘syscall_obj_generate_key’:
core/tee/tee_svc_cryp.c:1907:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
size_t alloc_size = 0;
^~~~~~
core/tee/tee_svc_cryp.c: In function ‘syscall_cryp_derive_key’:
core/tee/tee_svc_cryp.c:2975:3: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
size_t bin_size = params[0].content.ref.length;
^~~~~~
core/tee/tee_svc_cryp.c: In function ‘syscall_asymm_operate’:
core/tee/tee_svc_cryp.c:3560:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
size_t alloc_size = 0;
^~~~~~
core/tee/tee_svc_cryp.c: In function ‘syscall_asymm_verify’:
core/tee/tee_svc_cryp.c:3734:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
size_t alloc_size = 0;
^~~~~~

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Fix warning in register_shm()

Fixes a -Wdeclaration-after-statement warning in register_shm():
core/tee/entry_std.c:491:2: error: ISO C90 forbids mixed declarations and code [-Werror=declarati

core: Fix warning in register_shm()

Fixes a -Wdeclaration-after-statement warning in register_shm():
core/tee/entry_std.c:491:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
struct optee_msg_param_tmem *tmem = &arg->params[0].u.tmem;
^~~~~~

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: assure the reader that clear_file(), test_file() are safe

tee_tadb_dir always has files when nbits is greater than 0.
Point that out in clear_file() and test_file().

Reviewed-by: Jens Wikland

core: assure the reader that clear_file(), test_file() are safe

tee_tadb_dir always has files when nbits is greater than 0.
Point that out in clear_file() and test_file().

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Elvira Khabirova <e.khabirova@omp.ru>

show more ...

core: pta: socket: enable TA to query recv out buffer

Propagate out size for socket recv event when it's larger than the
supplied in size. Also enable passing a NULL buffer while querying the
size o

core: pta: socket: enable TA to query recv out buffer

Propagate out size for socket recv event when it's larger than the
supplied in size. Also enable passing a NULL buffer while querying the
size of the buffer.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: REE FS: report earlier unexpected REE FS reset

When REE FS dirf.db file is not found but RPMB stores a hash for
that file it means the REE FS was tampered. This change makes OP-TEE
core to rep

core: REE FS: report earlier unexpected REE FS reset

When REE FS dirf.db file is not found but RPMB stores a hash for
that file it means the REE FS was tampered. This change makes OP-TEE
core to report this status instead of creating the file and let a later
access fails due to empty content hash mismatch.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: REE FS: introduce CFG_REE_FS_ALLOW_RESET

New boolean configuration switch CFG_REE_FS_ALLOW_RESET that, when
enabled, will make OP-TEE OS to allow REE FS content to be reset in
the Linux filesy

core: REE FS: introduce CFG_REE_FS_ALLOW_RESET

New boolean configuration switch CFG_REE_FS_ALLOW_RESET that, when
enabled, will make OP-TEE OS to allow REE FS content to be reset in
the Linux filesystem even when RPMB FS is enabled and already stores a
REE FS rollback protection hash. This switch is intended to test purpose
where REE FS can be wiped because the device flash memory was programmed
with brand new build artifacts.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: fix populate_files() coverity warning

In populate_files() db->files is checked to be not NULL leading but at
another place db->nbits is checked instead before accessing db->files.
Both checks

core: fix populate_files() coverity warning

In populate_files() db->files is checked to be not NULL leading but at
another place db->nbits is checked instead before accessing db->files.
Both checks are OK since db->files mustn't be NULL if db->nbits is
larger than 0.

This confuses coverity to emit a warning, so change the function to
check db->nbits instead.

This fixes coverity scan:
CID 1501793 (#1 of 1): Dereference after null check (FORWARD_NULL)

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix tee_fs_dirfile_get_tmp() coverity warning

In tee_fs_dirfile_get_tmp() dirh->files is checked to be not NULL
leading but at another place dirh->nbits is checked instead before
accessing dir

core: fix tee_fs_dirfile_get_tmp() coverity warning

In tee_fs_dirfile_get_tmp() dirh->files is checked to be not NULL
leading but at another place dirh->nbits is checked instead before
accessing dirh->files. Both checks are OK since dirh->files mustn't be
NULL if dirh->nbits is larger than 0.

This confuses coverity to emit a warning, so change the function to
check dirh->nbits instead.

This fixes coverity scan:
CID 1501821 (#1 of 1): Dereference after null check (FORWARD_NULL)

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: rpmb: use IS_ENABLED on CFG_RPMB_FS_DEBUG_DATA

Replace #ifdef with if (IS_ENABLED()) for CFG_RPMB_FS_DEBUG_DATA.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jen

core: rpmb: use IS_ENABLED on CFG_RPMB_FS_DEBUG_DATA

Replace #ifdef with if (IS_ENABLED()) for CFG_RPMB_FS_DEBUG_DATA.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...